What is claimed: 

1. A virtual machine system for computer code behavior analysis, the virtual 
machine system having a software processor comprising: 

a behavior record storing behavior flags representative of computer code 
5 behavior observed by virtually executing the computer code under analysis 
within the virtual machine; 

a sequencer that stores a sequence in which behavior flags are set in the 
behavior record during virtual execution of the computer code under analysis; 
and 

10 simulated memory and a simulated operating system representative of a 

host real computer system, the computer code under analysis interacting with 
the simulated memory and the simulated operating system to generate the 
behavior flags, 

wherein the virtual machine passes data representative of the behavior 
15 record to the host real computer system prior to termination of the virtual 
machine. 
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2. A virtual machine system for computer code behavior analysis, the virtual 
machine system having a software processor, comprising: 

a register or structure that stores behavior flags representative of 
computer code behavior observed by virtually executing the computer code under 
5 analysis within the virtual machine; 

a register or structure that stores a sequence in which behavior flags are 
set in the behavior flags register or structure; 

an entry point table that stores all entry points to the computer code 
under analysis within the virtual machine; 
10 a structure that stores interrupt vector addresses, pointing at interrupt 

service routines loaded into memory reserved by the virtual machine when the 
virtual machine is initialized; 

a memory structure simulating input and output ports; 

a memory structure simulating processor memory; 
15 one or more operating system simulation shells that simulate values 

returned by a real operating system under which the computer code under 
analysis is intended to operate. 

3. The system of claim 2, wherein the software processor executes the 

20 computer code under analysis, or fragments of the computer code under analysis, 
starting at each of the entry points defined within the entry point table and 
produces a behavior pattern comprising a set of behavior flags. 
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4. The system of claim 2, wherein the software processor executes the 
computer code under analysis, starting at each entry point defined within the 
entry point table and produces a sequence in which the behavior flags are set or 

5 reset. 

5. The system of claim 2, wherein the software processor interprets a high 
level language within the virtual machine system. 

10 6. The system of claim 5, wherein the software processor executes the 

computer code under analysis, or fragments of the computer code under analysis, 
starting at each of the entry points defined within the entry point table and 
produces a behavior pattern comprising a set of behavior flags. 

15 7. The system of claim 5, wherein the software processor executes the 

computer code under analysis, starting at each entry point defined within the 
entry point table and produces a sequence in which the behavior flags are set or 
reset. 

20 8. The system of claim 2, wherein the software processor executes 32-bit or 
64-bit program code and the operating system simulation shell responds to 
application program interface calls. 
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9. The system of claim 8, wherein the software processor executes the 
computer code under analysis, or fragments of the computer code under analysis, 
starting at each of the entry points defined within the entry point table and 

5 produces a behavior pattern comprising a set of behavior flags. 

10. The system of claim 8, wherein the software processor executes the 
computer code under analysis, starting at each entry point defined within the 
entry point table and produces a sequence in which the behavior flags are set or 

10 reset. 
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